GitLab has released critical patches to address a severe security vulnerability in its Community Edition and Enterprise Edition software. This flaw, identified as CVE-2026-97229, has been rated with the highest possible CVSS score of 10.0, indicating its potential to cause significant damage. The vulnerability allows an unauthenticated user to execute arbitrary code on the GitLab server through a specially crafted regular expression in a CI/CD configuration. This issue arises due to insufficient validation of regular expressions, which could lead to an integer overflow.

The patches for this vulnerability have been made available in versions 19.4.2, 19.3.5, and 19.2.8 of the software. Alongside this critical fix, GitLab has also addressed three other high-severity bugs, underscoring the company's commitment to maintaining the security of its platform. The release of these patches follows closely on the heels of another critical vulnerability (CVE-2026-90970) in the AI Gateway, which had a CVSS score of 9.9 and allowed for arbitrary command execution.

The importance of these updates is highlighted by a previous incident where a similar maximum-severity flaw (CVE-2026-85706) in GitLab's software was actively exploited soon after its public disclosure. This history of vulnerabilities emphasizes the need for users to promptly apply the latest patches to protect their systems from potential exploits.